what kind of security? for instance web exploits can be written in any language even in bash scripts,. Your question is way to vague to give an accurate and pertinent answer.
Ask HN: What's the best programming language to learn for security?
11–20 of 54 posts
Re: Ask HN: What's the best programming language to learn for security?
#12The E language (http://erights.org/) was designed to express smart contracts back before Bitcoin was invented -- really forward-looking and, to me, educational. You don't in the least need to know it for a career in the field, but it changed how I think about security.
http://erights.org/elib/capability/ode/index.html is probably the best quick intro.
Re: Ask HN: What's the best programming language to learn for security?
#13You're going to want to learn more than one, but for your first programming language I would suggest Python.
There are already a lot of people who suggested you a laundry list of langauges: yeah, you'll need to learn them all. However, that takes years. Don't fool yourself by thinking it doesn't. It will come with time.
Re: Ask HN: What's the best programming language to learn for security?
#14Look into python and play around with scapy... look into Perl and play around with Metasploit... know how to implement your own Tor hidden-service keyserver and how to make your own site use an SSL/TLS cert... before you have completed all four of these tasks you will have a good idea of the landscape and will have learned a lot, possibly answering your own question.
Re: Ask HN: What's the best programming language to learn for security?
#15Depends on what type of security you want to get into.
General Pentesting: Python or something higher level. Lots of library and tool usage (i.e. scapy, nping, nmap, metasploit)
Application Security: Learn frameworks more than languages. How to work inside of Rails, Spring, ASP, PHP stuff, etc. Common security bugs that exist in these codebases, how to fix them, and how to recognize them. It is more important here HOW things work not how to make really big things work. There are tools that you need to know how to use too, like Burp or some kind of HTTP proxy.
Exploit Development/Reversing: Goes without saying you need to know C very well. You also need to know Assembly very well and how to navigate around the OS. How windows exploits work from the basics like finding kernel32.dll to bypassing ASLR and other types of exploitation techniques. Fuzzing, etc. This probably has the highest bar of entry.
Your side note, how many programming languages do you need to be successful. The answer is a minimum of 1 if you know everything about it. You can add a lot of value doing things like AppSec Consulting for Java if you know a ton about securing Java frameworks.
You can email me if you have any questions. I love talking security
Re: Ask HN: What's the best programming language to learn for security?
#16There are a lot of great answers on here (Python/Ruby for general scripting, C/C++/ASM for reverse engineering, web stack technology for web application security, etc) -- but I wanted to focus on a slightly different approach.
I've run security teams for the last six years or so, and it's surprising to some people how little programming is often involved in penetration testing and application security assessments. If you're looking to do network and/or (web|mobile) application security, it's often unnecessary.
That said: learning how to do some scripting is always beneficial, and clearly understanding how code works is very important to understanding systems, networks, and applications. My advice, though, is that if you're trying to work in security it's probably better to learn the fundamentals of the area(s) of security that interest you, rather than focusing on a programming language or framework that you think will be relevant.
There are a lot of great resources out there, but shoot me an email (address in profile) if you'd like a little more info.
Good luck!
Re: Ask HN: What's the best programming language to learn for security?
#17I love a question with a simple right answer:
(Ruby OR Python) AND C.
You can skip C if you don't want to do low-level work (embedded, kernels, writing shellcode for memory corruption exploits). Only a small fraction of security people do this kind of work. You cannot skip (Ruby OR Python), even if you don't ever plan to do web work (which is a dumb plan anyways).
Re: Ask HN: What's the best programming language to learn for security?
#18Do 2 things in parallel.
Learn C, there's plenty of open source C code strictly related to security, from OpenSSL, to OpenSSH, to the Linux kernel.
Learn full stack web programming (SQL, a language, html+js). As for the language, PHP could be good as there's a lot of history of (in)security, but I definitely recommend learning a framework - I like yii (yes it is), but choose any. Studying a framework is useful to learn how much things could go wrong, if not done properly (SQL injection, XSS injection, ...).
Re: Ask HN: What's the best programming language to learn for security?
#19Look into python and play around with scapy... look into Perl and play around with Metasploit... know how to implement your own Tor hidden-service keyserver and how to make your own site use an SSL/TLS cert... before you have completed all four of these tasks you will have a good idea of the landscape and will have learned a lot, possibly answering your own question.
Metasploit is Ruby. In 10 years of consulting with a progressively larger and larger team, I'm not sure I ever saw someone use scapy. It's not that scapy is bad, so much as that direct targeted low-level packet manipulation is kind of a 90s problem statement.
Re: Ask HN: What's the best programming language to learn for security?
#20There are a lot of great answers on here (Python/Ruby for general scripting, C/C++/ASM for reverse engineering, web stack technology for web application security, etc) -- but I wanted to focus on a slightly different approach. I've run security teams for the last six years or so, and it's surprising to some people how little programming is often involved in penetration testing and application security assessments. If…
Programming is a hard requirement for app pentesting.